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running within the European Patent Office, applied to all European patent applications filed as 
first filing and searched on or after 01 .07.03. Under this project the EPO issues together with 
the search report an opinion on whether the application and the invention to which it relates 
meet the requirements of the EPC. This non-binding opinion is issued free of charge as a 
service. This opinion may be used as the basis for an informed decision as to whether it is 
desired to pursue the application further or not. 



For further details of this pilot project, the applicant's attention is directed to the Official 
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The attached opinion reveals that the application or the invention to which it relates 
appear not to meet the requirements of the Convention (see comments on enclosed 
Form 2906). 

If the applicant wishes to continue with this application the examination fee must be paid. 
Where appropriate amendments can be filed to address the objections raised in the opinion, 
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issued as the first official communication under Article 96(2) and Rule 51(2) EPC. 
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The examination is being carried out on the following application documents: 
Text for the Contracting States: 

AT BE BG CH CY CZ DE DK EE ES Fl FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR LI 



Description, pages: 



1-13 



as originally filed 



Claims, No.: 



1-10 



as originally filed 



Drawings, sheets: 



1/4-4/4 



as received on 



26.03.2004 with letter of 



24.03.2004 



1 The following document (D) is referred to in this communication; the numbering 
will be adhered to in the rest of the procedure: 

D1: US-B1 -640531 8 

2 Claims 1 , 2, 3, 8 and 10 are not clear in the sense of Art. 84 EPC. 

2.1 Claim 1 is not clear because they fail to specify to which entity the "input module" 
belongs to or, in other words, for which entities the "input module" serves as an 
input (for the data sources or for the processing module?). The claim is thus not 
clear for a man skilled in the art from its wording alone and has to be clarified 
(EPC Guidelines C-lll,4.1). 



2.2 The frequent use of the conjunction pair "and/or" in claims 1 , 3 and 8 and the 
enumerations of features in claims 2 and 3 together with the statement "and any 
combination thereof" render the subject-matter for which protection is sought 
unclear due to the amount of possible alternatives introduced by this wording. It is 
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therefore not possible to examine the entire scope of protection of these claims. 
The claims have to be clarified (EPC Guidelines C-III, 3.7). 

2.3 Claim 3 is not clear because it refers to additional features which are not part of 
independent apparatus claim 1 per se. Indeed, claim 1 refers to a network 
security system whereas claim 3 specifies how numerical and textual values are 
"maintained" (EPC Guidelines C-III, 4.8a). The claim has to be clarified. 

2.4 Claim 1 0 is not clear because it specifies "said status and trend presenting 
means", "the supervisory system" and to "said countermeasures initiating means" 
without an antecedent definition of these terms. Instead, there is precedent 
subject-matter relating to "displaying means" and "reaction facilities". The wording 
of the claim has to be adapted (EPC Guidelines C-III, 4.1 , 4.2). 

2.5 Independent claim 10 has to contain all essential technical features and should 
not refer to the subject-matter of other claims in particular when this subject-matter 
relates to different entities (EPC Guidelines C-III, 4.8a). The reference to other 
claims has to be removed or claim 10 has to be reformulated as a dependent 
claim which appears to be possible in the present case. 

2.6 Claim 10 specifies "an automation system operator workstation in a network with 
an automation system [...]" which induces ambiguity regarding the subject-matter 
for which protection is sought. It is not clear if the claim relates to an automation 
system operator workstation or to an automation system comprising a system 
operator workstation and a network (see EPO-Guidelines C-III, 4.8b). The claim 
has to be clarified. 

2.7 Furthermore, claim 1 0 introduces ambiguity regarding the subject-matter for which 
protection is sought by specifying: "system operator workstation being connected 
to a security system" (EPC Guidelines C-III, 4.8a). Indeed, the claim defines its 
subject-matter by reference to another entity. The claim has to be clarified by, for 
example, specifying "connectable". 

3 As far as independent claim 1 is clear it does not fulfill the requirements of Article 
52(1 ) EPC because its subject-matter is not new in the sense of Article 54(1 ) and 
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(2) EPC. 

3.1 Document D1 discloses, in terms of claim 1 , a network security system for 

detecting security relevant irregularities in a network (column 2, lines 40-41 : "The 
present invention provides a real-time intrusion detection method and system"), 
comprising 

data sources located on and constituting the network, with means for generating 
network-security relevant data (column 8, lines 12-16: "Each host 151-153 
comprises a local controller that sends information about log auditing, login 
anomaly detection, logout anomaly detection, session monitoring and port scan 
detector functions to the central controller"; figure 9); 

an input module [for a processing module], with input handlers for various 
protocols to connect to the data sources (follows implicitly from column 8, lines 
1 2-1 6: "Each host 151-153 comprises a local controller that sends information 
about log auditing, login anomaly detection, logout anomaly detection, 
session monitoring and port scan detector functions to the central control- 
ler"; figure ?); 

at least one processing module, connected to said input module for access to 
said data sources, with means for translating said network-security relevant data 
into quantitative variables (column 8, lines 1 6-20: "The central controller can 
perform centralized auditing of events 154, data analysis 155, cross correla- 
tion of intrusion activity throughout the network 156 column 8, lines 38-40: 
" The system administrator may also alter the alarm thresholds or use prepro- 
grammed alarm thresholds 168", figures 9, 10); 

a supervisory system, with means for presenting processed data to a security 
system operator (column 8, lines 1 6-20: n The central controller [...] can alert the 
network system administrator 1 57 if anomalous activity is found"; column 8, 
lines 40-42: "The system administrator may select whether a warning is to be 
displayed on the system administrators graphical user interface 169" figures 
9,10); 
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and an interface module, with means for transferring said quantitative variables 
from the processing module to the supervisory system (follows implicitly from 
column 8, lines 40-42: " The system administrator may select whether a warning is 
to be displayed on the system administrators graphical user interface 169"; figure 
10). 

Since all features of independent claim 1 are known in combination from docu- 
ment D1 , the subject-matter of claim 1 is not new (Art. 54(1 )(2) EPC). Conse- 
quently, claim 1 is not allowable (Art. 52(1) EPC). 

3.2 It should be noted that even if the applicant were to interpret claim 1 in such a 
manner as to enable him to allege that its subject-matter was novel, based on 
minor differences between the features of these claims and those disclosed in 
document D1 , the subject-matter of claim 1 would still not involve an inventive 
step according to Articles 52(1 ) and 56 EPC. This due to the fact that, having 
regard to document D1 , the same object and the same type of solution as defined 
in claim 1 is disclosed. 



3.3 Insofar as claim 10 can be understood, it does not involve an inventive step 
according to Article 56 EPC. The integration of the supervisory system and the 
countermeasure initiating means of a network security system into the respective 
means of an automation system operator workstation is a juxtaposition (see also 
EPO Guidelines, Annex to Chapter IV, 2.1) of known devices functioning in their 
normal way and not producing any non-obvious working interrelationship. This 
view is also in-line with the problem statement on page 6, paragraph 3 of the 
description: providing the display to a person available round-the-clock which is 
often the case for a process operator of an automation system. An unexpected 
technical effect of the integration of these two different system cannot be recog- 
nized. 

4 Dependent claims 2-9 do not contain any additional features that would lead to 
patentable subject-matter as they are either disclosed in document D1 (claims 2, 
3, 4, 5, 9) or are non-technical as they refer to the mere representation of informa- 
tion (claims 6, 7, 8). 
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5 It is not at present apparent which part of the application could serve as a basis 
for a new, allowable claim. Should the applicant nevertheless regard some 
particular matter as patentable, an independent claim should be filed taking 
account of Rule 29(1) EPC. The applicant should also indicate in the letter of 
reply the difference of the subject-matter of the new claim vis-a-vis the state 
of the art (especially vis-a-vis document D1) and the significance thereof. 

Furthermore, the following points should be dealt with when filing a new set of 
claims: 

5.1 The independent claims should be in the two-part "characterized" form required by 
rule 29(1) EPC, having a pre-characterising part that correctly reflects the closest 
prior-art. 

5.2 The features of the claims should be provided with reference signs placed in 
parentheses to increase the intelligibility of the claim (Rule 29(7) EPC). This 
applies to both the preamble and characterising portion (see EPO-Guidelines, 
C-lll.4.11) 

5.3 To meet the requirements of Rule 27(1 )(b) EPC, the document D1 should be 
identified in the description and the relevant background art disclosed therein 
should be briefly discussed. 

5.4 The introductory portion of the description should be adapted to the new claims. 
Particularly, following from the disclosure of document D1 , the statement indicat- 
ing the technical problem to be solved by the invention requires a revision 

which should be effected taking the requirements of Rule 27(1 )(c) EPC into 
account (see EPO-Guidelines C-ll, 4.5). 

6 Care should however be taken during the revision, especially of the introductory 
portion and any statements of problem or advantage, not to add subject-matter 
which extends beyond the content of the application as originally filed (Article 
123(2) EPC). 

In order to facilitate the examination of the conformity of the amended application 
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with the requirements of Article 123(2) EPC, the applicant is requested to clearly 
identify the amendments carried out, irrespective of whether they concern amend- 
ments by addition, replacement or deletion, and to indicate the passages of the 
application as filed on which these amendments are based. 

If the applicant regards it as appropriate these indications could be submitted in 
handwritten form on a copy of the relevant parts of the application as filed. 
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